CVE-2019-4621: IBM Datapower Gateway

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.

Affected products

• IBM Datapower Gateway: from 7.6.0.0, up to and including 7.6.0.14; from 2018.4.1.0, up to and including 2018.4.1.5

Published 2019-12-09. Last modified 2026-06-17.